Class BcRSAAsymmetricKeyUnwrapper

java.lang.Object
org.bouncycastle.operator.AsymmetricKeyUnwrapper
org.bouncycastle.operator.bc.BcAsymmetricKeyUnwrapper
org.bouncycastle.operator.bc.BcRSAAsymmetricKeyUnwrapper
All Implemented Interfaces:
KeyUnwrapper
public class BcRSAAsymmetricKeyUnwrapper extends BcAsymmetricKeyUnwrapper
Lightweight unwrapper for RSA PKCS#1 v1.5 (rsaEncryption) key transport, used by the BC CMS / PKIX recipient implementations.

Bleichenbacher/Marvin note: PKCS#1 v1.5 RSA decryption is inherently vulnerable to adaptive chosen-ciphertext (Bleichenbacher / Marvin) attacks whenever an attacker can submit ciphertexts and distinguish a padding failure from a success -- including only by timing or observable behaviour. This unwrapper reports a decryption/padding failure by throwing (an OperatorException) rather than returning a random key of the expected length, so a service that decrypts attacker-supplied key-transport blobs with a static RSA private key and exposes the outcome (a distinguishable error, or a response-time difference) acts as such an oracle. The lightweight PKCS1Encoding offers a constant-time random-fallback mode (return a random key of the expected length on bad padding instead of throwing); the BC TLS stack wires it for the RSA key-exchange pre-master secret, but it is not applied here, so padding-oracle resistance for CMS/PKIX key transport is left to the protocol or application layer. Where this unwrapper backs an online decryption oracle, prefer RSA-KEM or RSA-OAEP key transport over PKCS#1 v1.5.

  • Constructor Details

    • BcRSAAsymmetricKeyUnwrapper

      public BcRSAAsymmetricKeyUnwrapper(org.bouncycastle.asn1.x509.AlgorithmIdentifier encAlgId, org.bouncycastle.crypto.params.AsymmetricKeyParameter privateKey)

  • Method Details